Privacy Policy

indiebrotherhood Privacy Policy
Effective: September 7, 2026 · Version 2026-09-09-privacy-v2

This policy explains how indiebrotherhood handles information. Contact: xchristopherrayx@gmail.com.

1. Information we handle
We handle account information (email, unique artist name, authentication identifiers, verification status, and profile choices); an age declaration and the resulting minor/adult eligibility status; content you choose to upload or enter; feature activity, XP, streaks, badges, Coin balances and transactions; purchase and subscription records; support messages; and security/technical data such as request time, device/browser information, IP-derived security signals, and error logs.

2. Age data
During signup, the server uses the entered birth date to determine whether the account is under 13, a 13–17 minor, or an adult. The exact birth date is not retained by indiebrotherhood after that calculation. We retain the derived age band, guardian-approval status, applicable policy versions, and declaration/approval times. For a teen account we encrypt the guardian email used to send a single-use approval link. Users without a sufficient adult declaration cannot access Hang Out, DMs, cyphers, battles, or Lyric Pro explicit mode.

3. How we use information
We use information to authenticate users; provide, personalize, secure, meter, and improve tools; maintain profiles and progress; process purchases; prevent fraud and abuse; moderate community features; respond to support; comply with law; and communicate important service changes.

4. Processing and providers
Google Firebase/Firestore and Cloud Run support authentication, application hosting, databases, and logs. Stripe processes payments. Google AI services may process prompts, selected content, and necessary context when a user invokes a cloud-AI feature. A feature described as browser-local processes its core media in the browser, but ordinary hosting, authentication, security, and telemetry requests can still occur. Optional AI actions may send selected extracted text or content to the named provider.

5. Sharing
We do not sell personal information. We share information only with service providers acting for the service, with other users when you intentionally use a community feature, during a legitimate business transition, to protect users or the service, or when required by law. Public/profile fields and community posts should be treated as visible to their intended audience.

6. Retention and deletion
Retention depends on the feature and legal/security need. Browser drafts may disappear when a session or local data is cleared. Lyric Pro may keep limited recent encrypted history—currently up to 10 songs or 24 hours—unless a feature states otherwise. Account, moderation, security, payment, tax, and dispute records may be kept longer where reasonably required. Request access, correction, or deletion at xchristopherrayx@gmail.com; some records may remain where law, fraud prevention, security, or dispute handling requires them.

7. Security
We use access controls, verified authentication, encryption measures, rate limits, monitoring, and separation of private records. No internet service is perfectly secure. Keep your password private and report suspected compromise promptly.

8. Children and community safety
Accounts are not intended for children under 13. Members aged 13–17 require approval through a parent or guardian email and cannot use adult-restricted features. We do not knowingly permit under-13 accounts. Report suspected child endangerment or predatory conduct immediately to xchristopherrayx@gmail.com.

9. Choices and changes
You can choose whether to invoke cloud AI, upload content, make a purchase, or join eligible community features. Material policy changes receive a new version and may require renewed acceptance. Questions: xchristopherrayx@gmail.com.